feat(nixos): add control center host with hypervisor gitops service

nixos/flake.nix

@@ -70,7 +70,7 @@
     };
 
     hosts = {
-      # Hosts will be populated here as they are migrated to the v2 branch.
+      izanagi.modules = [ ./hosts/izanagi ];
     };
   };
 }

nixos/hosts/izanagi/default.nix

@@ -0,0 +1,52 @@
+{ config, pkgs, ... }:
+
+{
+  networking.hostName = "izanagi";
+
+  homelab = {
+    # Enable the standard guest VM configuration
+    virtualisation.guest.enable = true;
+
+    # Enable standard GitOps for the Control Center itself
+    common.gitops.enable = true;
+    # We might pull from our Forgejo instance eventually, but for bootstrap
+    # it might need to pull from Github or the local Gitea if it's up.
+    # common.gitops.repoUrl = "https://git.depeuter.dev/Bos55/nix-config.git";
+
+    services = {
+      openssh.enable = true;
+
+      # Enable the Hypervisor GitOps service to provision OTHER VMs
+      hypervisor-gitops = {
+        enable = true;
+        repoUrl = "https://git.depeuter.dev/Bos55/nix-config.git";
+        pollInterval = "hourly";
+      };
+    };
+  };
+
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/var/lib/sops-age/keys.txt"; # Injected via Cloud-Init during Phase 4
+
+    secrets = {
+      proxmox_api_token.owner = "root";
+      forgejo_token.owner = "root";
+    };
+
+    templates."hypervisor-gitops.env".content = ''
+      PROXMOX_VE_API_TOKEN=${config.sops.placeholder.proxmox_api_token}
+      FORGEJO_TOKEN=${config.sops.placeholder.forgejo_token}
+      PROXMOX_VE_ENDPOINT=https://mikoshi:8006/
+      PROXMOX_VE_INSECURE=true
+    '';
+  };
+
+  # Make the secrets available to the hypervisor-gitops service via EnvironmentFile
+  systemd.services.hypervisor-gitops.serviceConfig.EnvironmentFile = [
+    config.sops.templates."hypervisor-gitops.env".path
+  ];
+
+  system.stateVersion = "24.05";
+}

nixos/hosts/izanagi/secrets.yaml

@@ -0,0 +1,5 @@
+# This is a placeholder SOPS file.
+# You must encrypt it with sops using your age key before deploying.
+# sops -e -i secrets.yaml
+proxmox_api_token: "PLACEHOLDER_TOKEN"
+forgejo_token: "PLACEHOLDER_TOKEN"

nixos/modules/common/gitops.nix

@@ -6,42 +6,7 @@ let
   updateScript = pkgs.writeShellApplication {
     name = "homelab-gitops-update";
     runtimeInputs = [ pkgs.git pkgs.nixos-rebuild pkgs.jq pkgs.coreutils ];
-    text = ''
-      set -euo pipefail
-
-      REMOTE_URL="${cfg.repoUrl}"
-      BRANCH="${cfg.branch}"
-
-      echo "Checking remote hash for $REMOTE_URL branch $BRANCH..."
-      
-      # Fetch remote hash, fallback to unknown if it fails
-      REMOTE_HASH=$(git ls-remote "$REMOTE_URL" "refs/heads/$BRANCH" | awk '{print $1}' || true)
-
-      if [ -z "$REMOTE_HASH" ]; then
-        echo "WARNING: Could not fetch remote hash. Forcing rebuild to be safe."
-        REMOTE_HASH="unknown_remote"
-      fi
-
-      LOCAL_HASH="unknown_local"
-      if [ -f /run/current-system/configurationRevision ]; then
-        LOCAL_HASH=$(cat /run/current-system/configurationRevision)
-      fi
-
-      echo "Remote hash: $REMOTE_HASH"
-      echo "Local hash:  $LOCAL_HASH"
-
-      if [ "$REMOTE_HASH" = "$LOCAL_HASH" ] && [ "$REMOTE_HASH" != "unknown_remote" ] && [ "$LOCAL_HASH" != "unknown" ]; then
-        echo "Hashes match. No update needed."
-        exit 0
-      fi
-
-      echo "Hashes differ or unknown. Triggering nixos-rebuild..."
-
-      # Trigger the build and switch
-      nixos-rebuild switch --flake "git+$REMOTE_URL?dir=nixos&ref=$BRANCH"
-
-      echo "Update successful."
-    '';
+    text = builtins.readFile ../../../../scripts/nixos-sync.sh;
   };
 
 in {
@@ -68,14 +33,13 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    # 1. Systemd Service and Timer for polling
     systemd.services.homelab-gitops = {
       description = "Homelab GitOps Update Service";
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${updateScript}/bin/homelab-gitops-update";
+        ExecStart = "${updateScript}/bin/homelab-gitops-update ${cfg.repoUrl} ${cfg.branch}";
         # Must run as root to rebuild the system
         User = "root";
       };
@@ -91,7 +55,6 @@ in {
       };
     };
 
-    # 2. Webhook listener for instant trigger
     sops.secrets."webhook-secret" = {};
 
     services.webhook = {
@@ -121,7 +84,6 @@ in {
     # Inject the secret as an environment variable into the webhook service
     systemd.services.webhook.serviceConfig.EnvironmentFile = config.sops.secrets."webhook-secret".path;
 
-    # 3. Builder Configuration
     sops.secrets."builder-ssh-key" = lib.mkIf cfg.useBuilder {};
 
     nix.buildMachines = lib.mkIf cfg.useBuilder [

nixos/modules/services/default.nix

@@ -2,5 +2,6 @@
   imports = [
     ./actions
     ./openssh
+    ./hypervisor-gitops
   ];
 }

nixos/modules/services/hypervisor-gitops/default.nix

@@ -0,0 +1,64 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.homelab.services.hypervisor-gitops;
+  
+  hypervisorSyncScript = pkgs.writeShellApplication {
+    name = "hypervisor-sync";
+    runtimeInputs = with pkgs; [ git opentofu coreutils ];
+    text = builtins.readFile ../../../../scripts/hypervisor-sync.sh;
+  };
+in {
+  options.homelab.services.hypervisor-gitops = {
+    enable = mkEnableOption "Hypervisor GitOps Service";
+    
+    repoUrl = mkOption {
+      type = types.str;
+      description = "The URL of the git repository to pull";
+    };
+
+    # TODO Replace with webhooks
+    pollInterval = mkOption {
+      type = types.str;
+      default = "hourly";
+      description = "Systemd calendar event for polling interval";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      git
+      opentofu
+    ];
+
+    systemd.services.hypervisor-gitops = {
+      description = "Hypervisor GitOps Polling Service";
+      
+      # We need network access to reach Forgejo and Proxmox API
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root"; # Needs root to read SOPS secrets potentially
+        
+        # We will create a state directory for the repo
+        StateDirectory = "hypervisor-gitops";
+        WorkingDirectory = "/var/lib/hypervisor-gitops";
+        
+        ExecStart = "${hypervisorSyncScript}/bin/hypervisor-sync ${cfg.repoUrl} opentofu/nodes/mikoshi";
+      };
+    };
+
+    systemd.timers.hypervisor-gitops = {
+      description = "Timer for Hypervisor GitOps Service";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = cfg.pollInterval;
+        Persistent = true;
+      };
+    };
+  };
+}

nixos/users/admin/default.nix

@@ -9,7 +9,7 @@ in {
       type = lib.types.listOf lib.types.str;
       default = [
         # HomeLab > NixOS > admin > ssh
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWIOOEqTy8cWKpENVbzD4p7bsQgQb/Dgpzk8i0dZ00T"
+        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIHOoTp+e6qWGn4Sco5CZ6G0zrX5NAQBpLlDVirncJ/HqAAAABHNzaDo="
       ];
     };
   };